from rest_framework import permissions

class IsAdminUser(permissions.BasePermission):
    """
    仅系统管理员可访问
    """
    def has_permission(self, request, view):
        return request.user and request.user.is_authenticated and request.user.role == 'admin'

class IsSurveyCreator(permissions.BasePermission):
    """
    调查表创建者可访问
    """
    def has_object_permission(self, request, view, obj):
        return request.user and request.user.is_authenticated and (
            request.user.role == 'admin' or
            obj.created_by == request.user 
        )

class ReadOnly(permissions.BasePermission):
    """
    仅允许GET方法的只读访问
    """
    def has_permission(self, request, view):
        return request.method in permissions.SAFE_METHODS



